Zavy360 | Zavy360

Dental practices hold some of the most sensitive personal data of any small business. Patient health records, medical histories, Medicare numbers, private health fund details, financial information, and personal identifiers are all stored and processed daily. In Australia, this data is protected by specific legislation, and practice owners have a legal obligation to ensure their technology systems meet these requirements.

Choosing practice management software is not just a clinical or operational decision. It is a data security decision. The software you use determines where patient data is stored, how it is protected, who can access it, and what happens if something goes wrong. Practice owners who treat software selection as a purely functional evaluation, ignoring the security and compliance dimension, expose their practice to legal, financial, and reputational risk.

This guide covers the specific Australian legal framework that applies to dental practice data, the security features you should demand from any software provider, and a practical checklist you can use during your evaluation.

Australian Privacy Law and Dental Practices

Australian dental practices are subject to the Privacy Act 1988 (Cth), which establishes the 13 Australian Privacy Principles (APPs). These principles govern how organisations collect, use, store, and disclose personal information. For dental practices, the requirements are stricter than for many other small businesses because health information is "sensitive information" under the Act, which attracts extra protections, and because health service providers are covered by the Act regardless of their turnover.

The Australian Privacy Principles That Matter Most

Several APPs have direct implications for how dental practices manage data:

APP 1 (Open and transparent management) requires practices to have a clearly expressed and up-to-date privacy policy that explains how patient information is handled. This includes the kinds of information you collect and hold, how you collect and hold it, the purposes for which you use it, how patients can access or correct it, how they can complain, and whether you are likely to disclose it overseas and to which countries.

APP 6 (Use or disclosure) limits how you use or disclose patient information beyond the purpose it was collected for, which is providing dental care. Other uses generally need the patient's consent or must fall within a listed exception. Direct marketing is covered separately by APP 7, and using health information for marketing requires the patient's consent.

APP 8 (Cross-border disclosure) is critical when evaluating cloud software providers. If your software sends or stores patient data outside Australia, APP 8 may apply, depending on whether the overseas provider can access and handle the data or simply stores it under your control. Where APP 8 applies, you generally remain accountable for how the overseas recipient handles it. In practice, choosing a provider that stores patient records in Australia, and tells you clearly about any feature that sends data offshore, is the simplest path.

APP 11 (Security of personal information) requires practices to take reasonable steps to protect personal information from misuse, interference, loss, unauthorised access, modification, or disclosure. This applies to both the practice's physical security and its digital systems, including the software platform chosen to manage patient records.

Record-Keeping and Retention Obligations

Beyond the Privacy Act, the Dental Board of Australia's Code of conduct requires practitioners to keep accurate, secure health records, and state laws set how long those records must be kept. In NSW, Victoria and the ACT, the law requires records to be kept for at least seven years after the last service for adults, and until age 25 for patients treated as children. Other states have no equivalent statute for private practices, so many practices apply the same periods as a minimum, and indemnity insurers often recommend keeping records longer.

These retention obligations mean your software provider must guarantee long-term data availability and integrity. If you switch providers or if a provider ceases operations, your clinical records must remain accessible for the required retention period. This is not a theoretical concern. Dental software vendors do change hands: Dentally, for example, was acquired in 2020 by Software of Excellence, part of Henry Schein One. A change of owner can bring new terms, pricing or platforms, so check what your contract says about access to your records.

The Notifiable Data Breaches Scheme

Since February 2018, the Notifiable Data Breaches (NDB) scheme under Part IIIC of the Privacy Act has required organisations to notify both the Office of the Australian Information Commissioner (OAIC) and affected individuals of an eligible data breach: one likely to result in serious harm, where remedial action has not removed that risk.

For dental practices, a notifiable breach could include:

Unauthorised access to patient records (e.g., a staff member accessing records without a clinical reason)
Ransomware attacks that encrypt or exfiltrate patient data
Accidental disclosure of patient information (e.g., emailing records to the wrong recipient)
Loss or theft of devices containing unencrypted patient data

If you suspect a breach, you must take reasonable steps to assess it within 30 days. If it is likely to result in serious harm, you must notify the OAIC and affected individuals as soon as practicable. Failing to comply with the scheme is an interference with privacy. Since December 2024 a company can face a civil penalty of up to 10,000 penalty units (currently about $3.64 million) for an interference with privacy, and a serious interference can attract the greatest of $50 million, three times the benefit obtained or, where that benefit cannot be worked out, 30% of adjusted turnover.

Your software provider's security posture directly affects your exposure to data breaches. A provider with weak security increases your risk; a provider with strong security, encryption, and access controls reduces it.

Data Sovereignty: Why Where Your Data Lives Matters

Data sovereignty refers to the principle that data is subject to the laws and governance structures of the country where it is physically stored. For Australian dental practices, this is a practical concern with real legal implications.

Australian Data Centres and Jurisdiction

Your practice's Privacy Act and NDB obligations apply wherever your data is stored. What storage location mainly changes is which other countries' laws can also reach that data, and how practical it is to enforce your rights if something goes wrong. It is not the only factor: the laws that apply to the provider and its own suppliers can matter too, so ask about both.

When data is stored offshore, even by a nominally "Australian" company, more rules come into play. Data held overseas can also be subject to that country's laws on government access, which adds a layer of legal complexity that Australian storage keeps simpler. Where APP 8 applies, the Australian practice remains accountable for how the overseas recipient handles the data, but enforcing this is significantly more difficult when the data is in a foreign jurisdiction.

What "Cloud" Means for Data Location

Not all cloud providers host data in Australia. Some use Amazon Web Services, Google Cloud, or Microsoft Azure regions located in Singapore, the United States, or Europe. The fact that the software company has an Australian office does not mean the data is stored in Australia. These are separate questions.

When evaluating any cloud dental software, ask specifically:

Where are the primary data centres located? (City and country)
Where are the backup/disaster recovery data centres located?
Is any patient data processed or temporarily stored outside Australia?
Which features, if any, send patient data outside Australia, and to which countries?

Zavy360's security practices include storing practice records in Australian data centres, and our AI Scribe data page explains how AI Scribe audio and transcripts are processed by contracted providers in the United States.

Questions to Ask Your Provider

Beyond data location, these questions reveal how seriously a provider takes data sovereignty:

Who owns the data: the practice or the software provider?
What happens to the data if the provider is acquired by a foreign company?
Can the practice export all data in a standard, usable format at any time?
What is the data retention policy, and does it let you meet the record retention rules in your state?

Security Features to Demand from Your Dental Software Provider

Security is not a feature to be grateful for. It is a baseline requirement. Here are the specific capabilities every dental software provider should offer.

Encryption at Rest and in Transit

All patient data should be encrypted both in transit (between your browser/device and the server) and at rest (while stored on the server). In-transit encryption should use TLS 1.2 or later. At-rest encryption should use AES-256 or an equivalent standard. Ask the provider for specifics: "we use encryption" without technical details is not a sufficient answer.

Access Controls and Audit Trails

Your software should support role-based access controls so that each staff member sees only the data relevant to their role. A receptionist should not have the same access as the principal dentist. A hygienist does not need access to financial reports.

Audit trails (automated logs of who accessed which records and when) are a key security control and help you show you have taken reasonable steps under APP 11. If a patient raises a concern about who has viewed their records, or you need to investigate a possible breach, you need a system that can show this quickly and accurately.

Backup and Disaster Recovery

Ask your provider to explain their backup strategy in detail:

How frequently are backups performed? (Continuous or daily at minimum)
Where are backups stored? (Should be geographically separate from the primary data centre)
How long are backups retained?
What is the recovery time objective (RTO): how quickly can the system be restored after a failure?
What is the recovery point objective (RPO): how much data could be lost in a worst-case scenario?

A provider that cannot answer these questions clearly has not invested sufficiently in disaster recovery.

Regular Security Assessments and Certifications

The provider should conduct regular security assessments, ideally including third-party penetration testing at least annually. Ask about relevant certifications and compliance frameworks. ISO 27001 certification, a SOC 2 Type II report, or alignment with the Australian Signals Directorate's Essential Eight are indicators of a mature security programme.

Staff Access Management

Your software should provide administrative controls for managing staff accounts, including:

Individual user accounts (no shared logins)
Role-based permission levels
Automatic session timeouts
Multi-factor authentication (MFA) for every user login
Immediate account deactivation when a staff member leaves the practice

Shared logins (where multiple staff members use the same username and password) are a significant security risk and make audit trails meaningless. Every user action should be attributable to a specific individual.

Practical Security Checklist for Practice Owners

Use this checklist when evaluating any dental software provider. Every item should receive a clear yes or no answer. Vague responses are a warning sign.

Data location: Are patient records stored in Australian data centres, and will the provider tell you in writing which features, if any, send data overseas?
Encryption: Is data encrypted in transit (TLS 1.2+) and at rest (AES-256)? Can the provider specify the encryption standards used?
Access controls: Does the system support role-based access with granular permissions? Can you restrict access to specific record types or functions by role?
Audit trails: Does the system automatically log all data access events? Can you generate an audit report for a specific patient or staff member on demand?
Backup and recovery: Are backups performed at least daily, stored in a geographically separate location, and tested regularly for restoration integrity?
Breach notification: Does the provider have a documented incident response plan? Will they notify you immediately if a breach occurs, and will they assist with your NDB scheme obligations?
Data ownership and portability: Does the practice retain full ownership of its data? Can you export your data in a usable format, and what does the provider charge for it?
Security certifications: Does the provider hold ISO 27001 certification (ask for the certificate number and scope) or a current SOC 2 report, or align with the ASD Essential Eight?
Staff training: Does the provider offer security awareness training or resources for your team? Do they provide guidance on configuring the system securely?
Termination and data return: If you leave the provider, what happens to your data? How long is it retained, and in what format is it returned to you?

Any provider that cannot answer these questions directly, or that deflects with marketing language rather than technical specifics, should be evaluated with caution.

Protecting Your Practice and Your Patients

Data security is not an IT problem to delegate. It is a core practice management responsibility. The Privacy Act, the NDB scheme, state health records laws and the Dental Board's Code of conduct create clear legal and professional obligations for dental practice owners. Choosing the right software provider is one of the most impactful decisions you can make to meet these obligations.

The technology exists to protect patient data effectively. Australian-hosted data centres, strong encryption, role-based access, comprehensive audit trails, and reliable backup systems are all available. The practice owner's job is to demand these capabilities, verify them, and hold providers accountable.

For a broader evaluation of cloud-based dental software platforms, including features beyond security, our cloud dental software guide covers what Australian practices should consider when moving to the cloud.

Want to understand how Zavy360 protects your practice data with ISO 27001:2022 certified security, encryption in transit and at rest, and practice records hosted in Australia? Book a demo and we will walk you through our security architecture and data protection approach.

Dental Data Security in Australia: What Every Practice Owner Must Know